Extracted

• • Target

    23bc8acbb8a1e716512ac2ea9426d3fc46938cccac426f344c0314aafb17769e.exe

  • Size

    726KB

  • MD5

    88153ac6837f5034a7ab44259c90f4dd

  • SHA1

    90085bacffa3b6a75252f9e06af2d7ac54886e75

  • SHA256

    23bc8acbb8a1e716512ac2ea9426d3fc46938cccac426f344c0314aafb17769e

  • SHA512

    fc5fa3bc1ad16fa3e1e8988253da0479b9235c7d051d82cde50e3da6ca95acff6d20483b4dc52778015f2344cc1edca68e9b184f8f507479b3ada5bf594be8cc

  • SSDEEP

    12288:MOX2iRzjEZ3eBNdQ6LN5LD8MYoSrwb+dpXeboencW3:MOmYzwIBDRjLHY7rhXeDncW3

  Score

  10^/10

  formbookbc01discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2